Webhook

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Export Lakewatch alerts to a webhook. When an alert is created, Lakewatch posts it as a JSON payload to an HTTPS endpoint you configure, where your own automation can act on it. For how export behaves across destinations, see Alert destinations.

Export to a webhook is one-way, from Lakewatch to your endpoint.

Webhook payload

When Lakewatch exports an alert to your webhook, it POSTs a JSON payload. Lakewatch sends a lakewatch.alert.created event when the alert is created. It also sends a lakewatch.alert.updated event for later changes to an already-exported alert, but only when update delivery is enabled for the destination. A close is an update that carries a terminal alert_state (RESOLVED or DUPLICATE), so there is no separate close event. For the setting that enables update delivery, see Configure settings.

Delivery is at most once per event, with no retry. The alert is still created in Lakewatch if delivery fails.

note

Keys are snake_case. Enum fields are sent as their string names, for example "SECURITY_ALERT", not numbers. Unset optional fields are omitted from the JSON rather than sent as null, so a missing numeric field is absent, not 0.

Headers

Each request includes the following headers:

• Content-Type: application/json
• User-Agent: Databricks-Webhooks/1.0
• X-Webhook-Event-Type: the event type
• X-Delivery-Attempt-Id: the delivery attempt ID
• X-Webhook-Timestamp: the delivery time in epoch milliseconds

Envelope fields

Field	Description
event_type	lakewatch.alert.created or lakewatch.alert.updated.
delivery_attempt_id	Unique per delivery attempt. Use it for de-duplication.
delivery_time_millis	Epoch milliseconds when the delivery was sent, not when the alert was created.
data	The alert object. See Alert fields.

Field	Description
event_type	lakewatch.alert.created or lakewatch.alert.updated.
delivery_attempt_id	Unique per delivery attempt. Use it for de-duplication.
delivery_time_millis	Epoch milliseconds when the delivery was sent, not when the alert was created.
data	The alert object. See Alert fields.

Alert fields

The data object contains the alert. The following fields are the ones most consumers act on:

Field	Description
alert_id	Globally unique alert ID (uuidv7). Correlate created and updated events for the same alert on this field.
seq_id	Human-friendly display ID, for example sec-42. For display only, not a key.
alert_type	SECURITY_ALERT.
alert_state	One of OPEN, IN_PROGRESS, MITIGATED, RESOLVED, or DUPLICATE.
severity	One of Informational, Low, Medium, High, or Critical. Informational-severity alerts are not exported.
title	Short alert title.
classification	One of FALSE_POSITIVE, BENIGN_POSITIVE, or TRUE_POSITIVE. Unset until an analyst triages the alert, so it appears on updated events rather than at creation.
assignee	The principal the alert is assigned to. Unset until assigned, so it appears on updated events.
alert_url	Deep link to the alert in the Lakewatch UI. May be unset.
created_at_millis	Epoch milliseconds when the alert was created.
created_by	The principal that created the alert: id, principal_type (one of REGULAR_USER, SERVICE_PRINCIPAL, or SYSTEM_USER), email, and display_name.

Field	Description
alert_id	Globally unique alert ID (uuidv7). Correlate created and updated events for the same alert on this field.
seq_id	Human-friendly display ID, for example sec-42. For display only, not a key.
alert_type	SECURITY_ALERT.
alert_state	One of OPEN, IN_PROGRESS, MITIGATED, RESOLVED, or DUPLICATE.
severity	One of Informational, Low, Medium, High, or Critical. Informational-severity alerts are not exported.
title	Short alert title.
classification	One of FALSE_POSITIVE, BENIGN_POSITIVE, or TRUE_POSITIVE. Unset until an analyst triages the alert, so it appears on updated events rather than at creation.
assignee	The principal the alert is assigned to. Unset until assigned, so it appears on updated events.
alert_url	Deep link to the alert in the Lakewatch UI. May be unset.
created_at_millis	Epoch milliseconds when the alert was created.
created_by	The principal that created the alert: id, principal_type (one of REGULAR_USER, SERVICE_PRINCIPAL, or SYSTEM_USER), email, and display_name.

The payload can also include name (the alert's resource name), description, rule_version, first_event_summary, first_event_at_millis, last_event_at_millis, total_event_count, and triggering_signal (the representative security event).

The following is an example lakewatch.alert.created payload:

JSON

{
  "delivery_attempt_id": "fde7344f-2786-4516-a30b-dbd920207c9c",
  "event_type": "lakewatch.alert.created",
  "delivery_time_millis": 1790205121081,
  "data": {
    "name": "rules/4b54c235-39e7-476e-aac8-260f123f4533/alerts/81030035-3fa7-4ac2-859f-4215ebeca2d9",
    "alert_id": "81030035-3fa7-4ac2-859f-4215ebeca2d9",
    "seq_id": "sec-512",
    "alert_type": "SECURITY_ALERT",
    "alert_state": "OPEN",
    "severity": "Medium",
    "title": "Suspicious login activity",
    "alert_url": "https://<workspace-host>/lakewatch/explore/alerts/sec-512",
    "first_event_summary": "Multiple failed logins from a new location",
    "total_event_count": 1,
    "created_at_millis": 1790204960768,
    "created_by": {
      "id": "147014482147330",
      "principal_type": "REGULAR_USER",
      "email": "analyst@example.com",
      "display_name": "Alex Analyst"
    }
  }
}

An updated event has the same shape, with event_type set to lakewatch.alert.updated, the current alert_state, and post-creation fields such as classification and assignee populated.

Prerequisites

An HTTPS endpoint that accepts POST requests and can process the alert JSON payload.

Configure webhook export

Configure a webhook destination for alerts in the Alerts settings section.

1. In the Lakewatch sidebar, go to Settings, then open Alerts.
2. Find the Export setting under Alerts.
3. Set the export destination to Webhook.
4. For Workspace, keep the current workspace unless the destination is behind a specific workspace's network, such as a PrivateLink endpoint or a region-restricted service. This workspace's network delivers the export.
5. In Webhook URL, enter the endpoint that alerts are posted to.
6. Save your changes.

For the full alert settings reference, see Configure settings.

Troubleshooting

• Payloads don't reach your endpoint: the URL is wrong, or the endpoint doesn't accept POST requests. Confirm the URL and that the endpoint is reachable and accepts a JSON POST.